How about just changing the signup process to "send us an email from your email address" and then you receive a reply with the further instructions/link? It would make it impossible to discover whether a user has signed up without gaining access to his/her email account. You could easily make this more abuse-resistant (and reduce the inevitable spam) by generating a temporary session ID and embedding it into the subject of the mailto: link, or even use temporary email addresses to receive registrtion requests.
“Invalid username or password” is a useless security measure
141–150 of 188 posts
Re: “Invalid username or password” is a useless security measure
#142> Consider throttling invalid login attempts by IP address or subnet. Oh hell no. First off that is completely ineffective. Botnets are common and inexpensive. But worse still a lot of users often share a single IP (e.g. university dorms, businesses, public wifi, etc). I agree with the first part of this article (i.e. that it is trivial to "prove" a username is valid, and that worse error responses aren't accomplishi…
Exponential backoffs also have the problem that it makes it far easier to lock someone out of their account. Or rather, it makes it possible to lock someone out of their account for an arbitrary amount of time. > When a password is set check it isn't in a common password dictionary I agree with this with short passwords . But for passphrases? No. I find it rather frustrating that (ex) diceware passwords are often rej…
> Exponential backoffs also have the problem that it makes it far easier to lock someone out of their account. Or rather, it makes it possible to lock someone out of their account for an arbitrary amount of time.
Why not allow the unlocking of an account through email and 2fa?
An email like, "Hey, we've locked your account because we've received a ton of incorrect login attempts. To unlock your account click the big button below OR visit www.example.com/longrandomhash"
And then have the user login again (and potentially use some sort of 2fa like facebook/github/google code generator).
Re: “Invalid username or password” is a useless security measure
#143Interesting premise. I think the original behavior is partly correct. The combination of user name and password doesn't match. Either one could be incorrect. Say my usual login is steven@example.com, and I do know my password. If I try to log in as stevon@example.com with my correct password, it is conceptually NOT the password that is incorrect. The user could legitimately make such typos, and should probably check both fields.
On the other hand, this is a reasonable argument for prompting on invalid user names, e.g. "This doesn't appear to be an existing account, make sure you typed it correctly, or try our [sign up page]".
Re: “Invalid username or password” is a useless security measure
#144I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email. Always send an email. If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message. The author has so…
Please don't always send an email. A malicious person can now start signing up every day with a bunch of emails resulting in users who do have an account receiving an email from your site daily/hourly saying "we noticed you're trying to sign up again". At which point they become annoyed with your service and either unsubscribe or delete their account. Hotmail do this everytime someone tries to reset my password which…
An attacker could already do this via nearly every service's "forgot my password" functionality, as you noted yourself in the case of hotmail.
As the original author noted, rate limiting is also a fundamental requirement for security. Eventually no more emails are sent because the offending IP addresses are effectively blocked.
Make email notifications an option for users (enabled by default, with an easy link in the email to disable), and you ensure your users that your service is secure, while giving them the ability and easy path to ignore it.
Re: “Invalid username or password” is a useless security measure
#145Leaving security aside, "incorrect username/password" is still the more correct and useful statement. Consider the case where you mistype your username (email). For sites like amazon, gmail, hotmail, yahoo, twitter, etc, it is entirely likely that the mistyped username is somebody else's valid username, you typed the password correctly, and "incorrect password" would hide the problem.
I've worked with a CRM product that allowed non-unique usernames. That's right the usernames could be duplicated, so we had like 10 jsmith's. It would parse the username/password combo, and if one matched, that's who you logged in as. I never got to test what happened when jsmith had the same password as another jsmith. I'm sure the results would have been terrifying and hilarious. Apparently, the history here is that it used to log people in using their email as their only username, but someone here didn't like that and the vendor tacked on this half-assed solution. So you email is your unique identifier but its not used during login.
I suspect there's a lot of poorly written software that still does stuff like this. The message is still valid in these cases as well.
Re: “Invalid username or password” is a useless security measure
#146I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email. Always send an email. If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message. The author has so…
Forcing the user to interact with an email client during the signup process before they've confirmed the availability of a username might be good for security, but it's a horrible way to gain users. That's a very high friction process. I generally agree with this comment, however.
You can just use the email address as the username then.
Re: “Invalid username or password” is a useless security measure
#147Earlier quoted context omitted.
This seems like a messaging problem? "Password does not match our records for username/email XXX. Please check that both password and username are correct." Responding to below This reads to me like a more verbose version of "Incorrect username or password." Note this version is not wordsmithed and could probably be done better but the goal and inherent difference of this to the original is to let the user know that…
This reads to me like a more verbose version of "Incorrect username or password." I'd favour the shorter version that gets the same point across.
It's not the same, since his message indicates that the username does exist whereas your message does it.
Re: “Invalid username or password” is a useless security measure
#148Earlier quoted context omitted.
Telling them "correct password, wrong email" seems like a bit of an information leak if you ask me. I think a "did you mean?" output in case of a bad password as long as there are lexically similar usernames in the database.
Ignoring the fact that doing that would be retarded, if you're following modern practices and hashing passwords with KDFs that's not really possible without killing your server.
Sorry, should have added a :-P to indicate my sarcasm.
Re: “Invalid username or password” is a useless security measure
#149Earlier quoted context omitted.
Forcing the user to interact with an email client during the signup process before they've confirmed the availability of a username might be good for security, but it's a horrible way to gain users. That's a very high friction process. I generally agree with this comment, however.
This is why I like federated login with the options of Google and Facebook. Why go through the hassle of creating a new password and sending a verification email, when the user can just click a couple buttons to sign in with a service indefinitely? The username can be chosen afterwards and never has to be re-typed.
My trouble with these things is that they invariably support multiple services, all of which I have accounts with, and I can never remember which one I'm using for any particular service.
Re: “Invalid username or password” is a useless security measure
#150Earlier quoted context omitted.
This reads to me like a more verbose version of "Incorrect username or password." I'd favour the shorter version that gets the same point across.
It's not the same, since his message indicates that the username does exist whereas your message does it.
"username or password incorrect" does not imply that the username was correct or incorrect. The system is saying one or both fields are incorrect.